8.3 Configuring Methods

Advanced Authentication supports authentication using Bluetooth method. The settings allows to enable or disable the Enable reaction on device removal option.

By default Enable reaction on device removal option is enabled. When the Enable reaction on device removal option is enabled and logon to Windows is performed by Bluetooth, then Operating System automatically locks if the Bluetooth device is disabled or it is out of range.

Advanced Authentication supports the Microsoft policy Interactive logon: Smart card removal behavior that allows you to specify an action on the card event. You can configure it to perform a force log off or lock a user session when the user inserts a card to the reader. This is supported for Microsoft Windows only.The Enable Tap&Go policy is located on the Card page of Methods section. By default, the policy is disabled and the card should be left on the reader when a user logs in. When the user takes off the card from the reader, the Windows Client runs an action that is specified in the Interactive logon: Smart card removal behavior policy. If the Enable Tap&Go policy is set to ON, users can tap a card to log in, to lock a session, or to log off (depending on Interactive logon: Smart card removal behavior policy) without leaving their cards on the readers.

The Email OTP authentication method sends an email to the user's e-mail address with a One-Time-Password (OTP). The user receives this OTP and needs to enter it on the device where the authentication is happening. This authentication method is best used with a second method like Password or LDAP Password in order to achieve multi-factor authentication and to prohibit malicious users from sending SPAM to a user's email box with authentication requests.

The following configuration options are available:

The settings allows to configure the Emergency Password authentication method. The method can be used as temporarily solution for the users who forgot smartphone or lost a card. Enrollment of the method is allowed only by security officers. Users are not permitted to enroll it.

It is possible to manage the following security options:

The fingerprint authentication method uses a fingerprint scanner to authenticate.

To configure the fingerprint authentication, perform the following steps:

You can configure certificate settings for the FIDO U2F authentication method. By default, Advanced Authentication does not require the attestation certificate for authentication by FIDO U2F compliant token. Ensure that you have a valid attestation certificate added for your FIDO U2F compliant tokens, when you configure this method. A Yubico attestation certificate is pre-configured in the Advanced Authentication appliance. Click Add to add a device manufacturer certificate that must be in a PEM format. To enable check of attestation certificate, switch the Require attestation certificate option to ON. You can also turn the Disable built-in certificate option to ON if you do not want to use the built-in Yubico attestation certificate.

deb http://packages.dotdeb.org jessie all
deb-src http://packages.dotdeb.org jessie all

mkdir –p /etc/nginx/ssl
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/proxy.key -out /etc/nginx/ssl/proxy.crt

server {
listen 443 ssl;
error_log /var/log/nginx/proxy.error.log info;
server_name nam.company.local;
ssl_certificate /etc/nginx/ssl/proxy.crt;
ssl_certificate_key /etc/nginx/ssl/proxy.key;
location ~ ^/account {

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_pass https://<appliance_IP>$uri?$args;
}
location ~ ^/static {

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_pass https://<appliance_IP>$uri?$args;
}
location ~ ^/admin {

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_pass https://<appliance_IP>$uri?$args;
}
location / {

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_read_timeout 300;
proxy_pass https://<NAM_IP>;
}
}

ln -s /etc/nginx/sites-available/proxy /etc/nginx/sites-enabled/proxy
service nginx reload

The settings allows to configure security options for LDAP passwords (passwords stored in the used repository).

LDAP Password is required for Advanced Authentication Clients, because the Advanced Authentication Clients retrieve password from the Advanced Authentication Server to validate it. If you do not have a LDAP Password method in a used chain, a prompt is displayed to perform the synchronization. A prompt is displayed only for the first time if Save LDAP password option is set to ON until the password is changed or reset. A prompt for synchronization is displayed each time if the Save LDAP password option is set to OFF.

OATH stands for Initiative for Open Authentication and is an industry-wide collaboration to develop an open reference architecture using open standards to promote the adoption of strong authentication using One-Time-Passwords.

Advanced Authentication Framework supports two different types of OATH OTP and these are:

To access the settings open Advanced Authentication, Methods section, click Edit button next to OATH OTP.

For the HOTP variant you can specify the following parameters:

During enrollment or HOTP counters synchronization in Self-Service Portal the Enrollment HOTP window equal to 100 000 is used. This is necessary because the HOTP tokens may be used during a long period before enrollment in Advanced Authentication and its value is unknown and could be even equal to some thousands. This is secure as users need to provide 3 consequent HOTPs.

The TOTP settings contain the following parameters:

Advanced Authentication Framework also supports the import of PSKC or CSV files. These are token files with token information in them. To do this follow the instruction below:

When the tokens are already imported you see the list and it's required to assign the tokens to users. If can be done in two ways:

Token001, 15d2fa517d3c6b791bd4cc2044c241429307001f
Token002, 8c557fc050721037fd31e1d3345b5d3263263e0f, totp, 8
Token003, 658208efea5ac49d5331ba781e66f2c808cccc8e, hotp, 6
Token004, 89f0dfe1c90379da6a11aaca2fc1070f606efe36, totp, 6, 60

The settings allows to configure security options for passwords stored in the appliance. They are applied, for example, for the appliance administrator and other local accounts.

The section allows you to upload the trusted root certificates. The following requirements for the certificates must be met:

Configuring the Environment for a Standalone Root CA

Configuring the Environment for a Subordinate CA

For more information see the articles on Single Tier PKI Hierarchy Deployment and Two Tier PKI Hierarchy Deployment.

To upload a new trusted root certificate:

With the Radius Client Authentication Method the authentication framework will forward the authentication request to a third party RADIUS server. This can be any RADIUS server. A specific example of when to use this Authentication Method is if you have a working token solution like RSA, or Vasco and want to migrate your users to the Advanced Authentication framework. Some users will be able to still use the old tokens and new users can use any of the other supported Authentication Methods.

To use this method you will need to create an RADIUS Client on the third party RADIUS server with the hostname of IP address of this appliance. If you have multiple appliances you should add them all as RADIUS Clients.

The following configuration options are available:

The SMS OTP authentication method will send an SMS text to the user's mobile phone with a One-Time-Password (OTP). The user will receive this OTP and needs to enter it on the device where the authentication is happening. This authentication method is best used with a second method like Password or LDAP Password in order to achieve multi-factor authentication and to prohibit malicious users from sending SPAM a user's phone with authentication requests.

The following configuration options are available:

This Authentication Method is mostly used in fall-back scenarios where a user does not have access to his normal strong authentication method. The authentication method works in such a way that a user needs to answer a series of questions that are pre-defined in this configuration section. When the user tries to authenticate using the Security Questions he or she will be provided with a random set out of these pre-defined questions. By answering the questions correctly the user will get access. Below you can configure how many of the answers should be correct before the user gains access.

When you decide to use this Authentication Method please follow some guidelines.

It is essential that we use good questions. Good security questions meet five criteria. The answers to a good security question are:

Some examples of good, fair, and poor security questions according to goodsecurityquestions.com are given below. For a full list please visit this website.

GOOD

What is the first name of the person you first kissed?

What is the last name of the teacher who gave you your first failing grade?

What is the name of the place your wedding reception was held?

In what city or town did you meet your spouse/partner?

What was the make and model of your first car?

FAIR

What was the name of your elementary / primary school?

In what city or town does your nearest sibling live?

What was the name of your first stuffed animal, doll, or action figure?

What time of the day were you born? (hh:mm)

What was your favorite place to visit as a child?

POOR

What is your pet's name?

In what year was your father born?

In what county where you born?

What is the color of your eyes?

What is your favorite _____?

The following configuration options are available:

So when Correct questions for logon is set to 3 and the Total questions for logon is set to 5 then the user only needs to enter 3 correct questions out of a set of 5.

The Smartphone authentication method uses an app on your smartphone to do out-of-band authentication. This means that the authentication is happening over a different channel than the initiating authentication request.

For example, if you are logging into a website, then the Smartphone authentication method will send a push message to your mobile phone. When opening the Advanced Authentication app the user will be presented with an Accept and a Reject button where he can decide what to do. If the user pushes the Accept button the authentication request will be sent over the mobile network (secure) back to the Authentication framework. Without typing over an OTP code the user will be granted access.

When the smartphone doesn't have a data connection, a backup OTP authentication can be used.

This Authentication Method is best used in combination with another method like Password or LDAP Password in order to achieve multi factor authentication and protect the user from getting SPAM push messages.

The following configuration options are available:

You can configure Geo-fencing with the Smartphone method. Geo-fencing allows you to authenticate with the Smartphone method with one more factor, which is the geographical location. When you enable geo-fencing, users will be able to authenticate with Smartphone from only allowed geographical locations. You must enable the policy Geo fencing options to use geo fencing.

To configure geo-fencing, you need to draw a boundary of the location to be authenticated with a polygon. To configure geo-fencing, perform the following steps:

Authentication flow

The following chart demonstrates the authentication flow:

A user is authenticating on endpoint (which can be the user's laptop with Advanced Authentication Windows Client installed or a website etc.) by Smartphone method.

HTTPS protocol is used for the communication.

Access configuration

The settings allow you to configure the Swisscom Mobile ID authentication method. This method provides strong authentication based cryptographic materials that are stored and protected in the SIM card of a user’s mobile phone.

You can configure the following settings for this method:

The section also allows you to upload the Swisscom client certificates:

The section contain security settings for Voice authentication method. Advanced Authentication will call user and the user will need to enter a pin code, which should be predefined in Advanced Authentication Self-Service Portal during the authenticator enrollment.

It's possible to manage the following settings:

The settings allow you to configure the Voice OTP authentication method. The user will receive this OTP in a call and the OTP has to be entered on the device where the authentication is happening. This authentication method is best used with a second method like Password or LDAP Password in order to achieve multi-factor authentication.

You can configure the following settings for this method: